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Abstract 

The Self-Repairing Right Control System (SRFCS) Pro- 
gram is sponsored by the USAF and flight-tested at the 
NASA Ames Research Center, Dryden Right Research 
Facility. The program objective is the proof-of-concept 
demonstration of the SRFCS using the NASA F-15 Highly 
Integrated Digital Electronic Control (HIDEC) Right Re- 
search Facility. The program approach exploits the inher- 
ent control redundancies of advanced aircraft by fully uti- 
lizing its multiple control effectors and optimally integrat- 
ing their secondary aerodynamic characteristics. This is ac- 
complished by way of reconfiguration after control effector 
failures. This allows the aerodynamic forces and moments 
produced by the other control effectors to become the redun- 
dant elements instead of massive redundant hardware. The 
necessary forces and moments are generated by the integra- 
tion of alternate control surfaces to provide the required air- 
craft motion. This paper describes the F-15 HIDEC aircraft 
and the unique features used during the SRFCS flight test 
program. The development leading to the current SRFCS 
configuration will be highlighted. The presentation includes 
preliminary flight test results that address the operation of 
the overall system, as well as the individual technologies. 

The NASA F-15 flight test was the first demonstration 
of real-time reconfiguration and diagnostics on a high- 
performance fighter. 

Nomenclature 

AI artificial intelligence 

CAS control augmentation system 

CND cannot duplicate 

DFCC digital flight control computer 

’Project Manager. 

“Project Engineer. Member AIAA. 
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DFBW 

digital fly-by-wire 

EGE 

effector gain estimator 

FDIE 

fault detection isolation and estimation 

HIDEC 

highly integrated digital electronic control 

HUD 

head-up display 

NASA 

National Aeronautics and Space 
Administration 

NCI 

navigation control indicator 

OES 

onboard expert system 

RTOK 

retest OK 

SIDC 

system impairment detection and 
classification 

SRFCS 

self-repairing flight control system 

SYSDYN 

system dynamic model 

USAF 

United States Air Force 


Symbols 


a 

amount of span remaining 

B* 

impaired control matrix 

K 

Kalman gain 

9 

dynamic pressure, lb/ft 2 

Stab 

stabilator 


velocity, calibrated airspeed, kn 

w 

weighting matrix 

X A 

actual aircraft acceleration vector 

u 

X Error 

acceleration error vector 

a 

XlMP 

impaired model acceleration vector 

X M 

aircraft model acceleration vector 

z~ l 

one-cycle time delay 

a 

angle of attack, deg 

AS 

change command vector 
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AS, 

incremental change command vector 

5 

stabilator actual postion 

Sc 

stabilator command 

ScAS 

CAS command 

S Pilot 

command pilot is giving to aircraft 

S Surface 

surface command 


Introduction 

System failure or aircraft damage causing loss of con- 
trol capability can compromise mission objectives and even 
result in loss of aircraft. The self-repairing flight control 
system (SRFCS) flight development program directly ad- 
dresses this issue with a system design that can detect flight 
control system failures or measure damage. The SRFCS 
can immediately reconfigure the control system command 
to control the aircraft and even preserve mission potential. 
Furthermore, the system diagnostics process can detect in 
flight the type of faults that are difficult to isolate post- 
flight, which can save excessive ground maintenance time 
and cost. The SRFCS diagnostics feature enhances aircraft 
alert readiness by reducing ground servicing time. 

The control systems of today’s fighter aircraft have the 
control power and surface displacement to maneuver the 
aircraft in a very large flight envelope, with surplus force 
capacity available from each control surface. Digital flight 
control processors are designed to include the built-in status 
of the control system components, as well as sensor informa- 
tion on aircraft control maneuver commands and response. 
In the event of failure or loss of a control surface, the SRFCS 
utilizes this capability to reconfigure control commands to 
the remaining control surfaces, and thus preserve the ma- 
neuvering response. This reconfiguration system permits 
the damaged aircraft to continue the mission safely or re- 
turn to base. Damage detection must be fast and accurate, 
and reconfiguration must restore sufficient flight response. 

Correct postflight repair is the key to low maintainability 
support costs and high aircraft mission readiness. The SR- 
FCS utilizes the large database available with digital flight 
control systems to diagnose faults. Built-in test and sensor 
data are used as inputs to an onboard expert system (OES) 
process to accurately identify failed components for post- 
flight maintenance action. This diagnostic technique has the 
advantage of functioning during flight. It is especially useful 
in identifying intermittent faults that are present only dur- 
ing maneuver g loads or high hydraulic flow requirements. 
These faults are difficult to isolate in current postflight main- 
tenance, resulting in cannot duplicate (CND) inconclusive 
ground checks and excessive support man-hours. 

A number of SRFCS feasibility studies 1 ” 5 have devel- 
oped and evaluated potential SRFCS method studies. Based 
on these studies, the USAF Wright Research and Develop- 
ment Center sponsored the SRFCS development and flight 
test program. The NASA Ames Research Center, Dryden 


Flight Research Facility worked with the contractor, Mc- 
Donnell Aircraft Company and subcontractor. General Elec- 
tric Controls Division. Together they developed the flight 
system to test the reconfiguration and onboard maintenance 
diagnostics concepts on the NASA F-15 highly integrated 
digital electronic control (HIDEC) fighter aircraft. 

Key objectives of the program were: 

1. To flight-evaluate a control reconfiguration strategy 
with three types of control surface failure. 

2. To evaluate a cockpit display that will inform the pilot 
of the maneuvering capacity of the damaged aircraft. 

3. To flight-evaluate the OES maintenance diagnostics 
process using representative faults set to occur only un- 
der maneuvering conditions. 

The objective of the flight test program was to transi- 
tion real-time reconfiguration and expert maintenance di- 
agnostics technology to the operational community. Flight 
demonstration is important in validating and evaluating 
technology for future aircraft. Flight test exposes concepts 
to the real-world environment, forcing potential problems 
to be addressed. It also provides indisputable evidence of 
a concept’s validity. In addition, flight evaluation improves 
the chances of getting a system into production. 

Flight Research Aircraft With Self-Repairing 
Flight Control System 

The F-15 HIDEC Flight Research Facility is an ideal can- 
didate for initial evaluation of this technology. A discussion 
of its unique features follows. 

Figure 1 shows the F-15 aircraft flown in the SRFCS flight 
development program. The aircraft is equipped with a dual- 
channel digital flight control system and a Hawk/3 2-bit pro- 
cessor (Rolm Corporation, Santa Clara, California) having a 
high throughput and memory capacity. Full-authority elec- 
tronic control of the ailerons was added to the test aircraft 
through a series servo controller, shown in Fig. 2. Pilot stick 
commands to the aileron are transmitted by mechanical link- 
age; the SRFCS reconfiguration commands are added to the 
aileron through the series servo. 

The SRFCS utilized the high-capacity Hawk/32 proces- 
sor for the major reconfiguration subroutines, the cockpit 
selection of test modes, the expert system diagnostics, dis- 
play generation, and flight test data acquisition. Additional 
flight control computer software included impairment con- 
trol of the right stabilator, addition of the SRFCS correction 
commands, and signals used for the expert system diagnos- 
tics. A summary of the software requirements to implement 
SRFCS is shown in Fig. 3. 

In addition, the test aircraft required changes to the cen- 
tral computer to link the cockpit navigation control indicator 
(NCI) control panel and displays to the Hawk/32 processor 
and the digital flight control computer (DFCC). The pilot 
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can use the addressing feature of the NCI panel to select the 
various failure impairments and SRFCS test modes. Figure 
4 illustrates the aircraft systems integration for implement- 
ing SRFCS. 

The NASA F-15 HIDEC contains full instrumentation 
and data recording with real-time telemetry of key parame- 
ters and pilot displays. The Hawk/32 processor also has a 
data recording system, used for the OES maintenance diag- 
nostics system. 

Technical Overview 

The F-15 HIDEC SRFCS program has developed, 
implemented, and flight-tested a SRFCS. This pro- 
gram includes control reconfiguration, a head-up display 
(HUD) positive pilot alert system, and knowledge-based 
maintenance diagnostics. 

The SRFCS program approach exploits the inherent con- 
trol redundancies of advanced aircraft by fully utilizing its 
multiple control effectors and their secondary aerodynamic 
characteristics. This is accomplished by reconfiguration, af- 
ter control effector failures, to allow control substitution by 
the remaining effectors. Instead of using massive redundant 
hardware on each effector to achieve fault tolerance and re- 
liability, the redundant elements become the aerodynamic 
forces and moments produced by the other control effec- 
tors. The necessary forces and moments are generated by 
the alternate control surfaces to provide the required aircraft 
motion. 

In today’s fighter and transport-commercial aircraft, the 
control systems have the power and surface displacement to 
maneuver the aircraft in a very large flight envelope, with 
surplus force capacity available from each control surface. 
In the event of failure or loss of a control surface, the SRFCS 
utilizes this capability to reconfigure control commands to 
the remaining control surfaces, and thus preserve the ma- 
neuvering response. 

Reconfiguration is one of the few technologies that holds 
promise to meet the availability and survivability require- 
ments for aircraft in a hostile environment, while minimiz- 
ing the complexity and costs of the system. Knowledge- 
based diagnostics address the timely and accurate fault iso- 
lation for maintenance and the unnecessary removal of non- 
failed equipment. 

The technologies demonstrated in this flight program in- 
clude control reconfiguration, fault detection and isolation, 
positive pilot alert, and maintenance diagnostics. 

Control Mixer Reconfiguration Strategy 

The core element of the reconfiguration strategy is the 
control mixer. The mixer can accept the outputs of a pre- 
existing set of control laws designed for an unimpaired air- 
plane and reallocate these output commands for an impaired 
airplane to the surviving effectors. 


Fault Detection and Isolation 

Fault isolation is accomplished by hypothesis testing 
through sequential probability ratio tests, a scheme success- 
fully used on the NASA F-8 digital fly-by-wire (DFBW) an- 
alytic redundancy management experiment. 

Positive Pilot Alert 

An integral part of the reconfiguration philosophy is the 
presentation of surviving flight control system status infor- 
mation to the pilot, including a situation assessment of the 
existing performance limits of the aircraft failure-damage. 

Maintenance Diagnostics 

The onboard computer-based fault diagnostic system for 
the flight control system reduces the RTOK (retest OK) 
and the CND (cannot duplicate) problems. This approach 
uses artificial intelligence (AI) to isolate failures occurring 
in flight. It uses available built-in test signals and addi- 
tional sensor information on maneuver conditions and cock- 
pit switch events that are present at the time of failure. Fact 
relationships are grouped in rules to find the most likely 
failure using an expert system forward-chaining inferenc- 
ing process. Details of the inferencing process can be found 
in Ref. 6. 

Self-Repairing Flight Control System 
and Technologies 

The SRFCS tested was capable of emulating an impair- 
ment and reconfiguration after detection of the impairment. 
The SRFCS impairment-failure modes could be selected 
by the pilot and flown to assess the performance of the 
F-15 aircraft with and without the impairment. Figure 5 is 
a block diagram of the F-15 SRFCS implementation which 
includes both the standard mechanical and electronic con- 
trol augmentation system (CAS). The F-15 HIDEC CAS 
serves to provide stability augmentation and command re- 
sponse enhancement through control laws implemented in a 
dual-channel DFCC. 

The baseline mode is unchanged until an impairment is 
introduced. Two SRFCS commands, shown in Fig. 5, were 
added to the F-15 HIDEC CAS servo controller commands. 
The first command forces the control system to represent 
failure conditions. (This software module is for flight test 
only.) The second command adds a reconfiguration correc- 
tion to each control surface servo controller. 

The flight test aircraft is configured with three impair- 
ments that are selectable from the pilot’s commands. All 
impairments affect the right-horizontal stabilator. The im- 
pairments are activated with software commands to the sta- 
bilator servo actuator to accurately represent the desired fail- 
ure (Fig. 5). The commands negate the mechanical system 
inputs and pattern the stabilator for the desired impairment. 
Once the failure type is selected and activated by the pilot, it 
remains active throughout the fault detection sequence and 
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pilot evaluation of the reconfigured airplane. Both the fail- 
ure and the correction commands disappear upon pilot de- 
activation of the reconfiguration test mode through a switch 
on the control stick. 

Three types of failure modes were mechanized and 
flight-tested. 

1. Locked at trim -representing hydraulic or mechanical 
failure. 

2. Locked at an offset position-representing a failure 
caused by a hydraulic or mechanical jam. Values up 
to 6° -offset locked position can be flown. 

3. Partial surface loss-representing a portion of the right 
stabilator missing-because of midair collision or battle 
damage of 50 percent, 80 percent, and 100 percent. 

Fault Detection, Classification, and Estimation 

The fault detection process involves pairwise hypothesis 
testing performed with sequential probability ratio tests to 
identify the failed flight control surfaces. Figure 6 showsa 
block diagram of the system impairment detection and clas- 
sification (SIDC). 

To show the difference in normal aircraft, as opposed to 
impaired aircraft response, acceleration residual errors are 
used to trigger the fault detection. After further processing, 
the acceleration residual errors identify the surface. This in- 
formation is then sent to either the mixer, if local failures 
are identified, or the effector gain estimator (EGE) subrou- 
tine for partial surface loss failures. 

The amount of surface damage is estimated as a span loss 
by the EGE, shown in Fig, 7, The missing span value is es- 
timated using a Kalman filter estimator process by compar- 
ing aircraft acceleration data with a model of the damaged 
aircraft 

Reconfiguration 

The fault detection isolation and estimation (FDIE) pro- 
vides information on aircraft damage used in the reconfig- 
uration mixer shown in Fig. 8. After failure detection and 
surface impairment damage estimation, the SRFCS system 
utilizes two aircraft models responding in real time to the 
same commands controlling the F- 15 aircraft. These mod- 
els continually output accelerations of both the undamaged 
and damaged aircraft. 

Correction commands can be found that will cause the 
acceleration error to be reduced in the model. These same 
commands can also be added to the real aircraft surface com- 
mands to restore normal control. The calculation of these 
correction commands uses an inverse matrix multiplication 
described further in Ref. 6. The matrix is weighted with the 
control limits of the remaining control surfaces. This allows 
the forces and moments on the aircraft to be as close as pos- 
sible to the forces and moments on the unimpaired aircraft. 


Cockpit Display and Control 

Controls in the cockpit allow the aircraft test pilot to se- 
lect the type of impairment and the test mode desired. Ei- 
ther separate selection of the FDIE or reconfiguration mixer 
subroutines can be made, or the complete sequence of detec- 
tion, isolation, and reconfiguration process can be activated. 
A reset or decouple command returns the aircraft to normal 
flight control operation. 

After detection of the fault, a special pilot positive alert 
display is added to the HUD, showing the failed surface and 
the maneuver limits imposed by the reconfigured system. 
As shown in Fig. 9, this display cues the pilot not to ex- 
ceed remaining flight control system limitations necessary 
for successful reconfigured flight This is achieved if the pi- 
lot maintains a steering symbol inside a maneuver authority 
box. The box size is a function of the impairment and the 
current flight condition. 

Onboard Expert System Maintenance Diagnostics 

In addition to the reconfiguration, the SRFCS has an ex- 
pert system capability that can detect and isolate system 
component failures occurring in routine aircraft use. These 
onboard diagnostics are adept at finding intermittent faults 
that happen only in flight and relate to casual events such as 
maneuver action, cooling temperature, pilot input sequence, 
or other fact relationships that may be impossible to recon- 
struct in postflight maintenance troubleshooting. 

Flight Test Process 

Figure 10 shows the flight envelope used for SRFCS de- 
velopment. The system was developed for the design enve- 
lope but it was also tested in the pilot maneuver envelope. 
The pilot could select various impairments and SRFCS test 
modes. Table 1 displays the test conditions flown: (a) im- 
pairments of the right stabilator; (b) the maneuver sequence, 
and (c) the SRFCS subroutine or test mode that could be se- 
lected by the pilot. 

Tests were also conducted on the OES diagnostics using 
maneuver sequences designed to trigger the fault scenarios 
shown in Fig. 11. The SRFCS flights from December 1989 
to March 1990 tested scenario 1 to scenario 5; scenario 6 
had been flown successfully in March I989. 1 

Preliminary Flight Test Results 

The summary results of the FDIE are shown in Fig. 12. 
These results are preliminary; the test data are being ana- 
lyzed for comparison of design response against flight re- 
sponse. The FDIE performance was directly related to the 
onboard simulation model fidelity. 

The flight performance of the reconfiguration mixer was 
judged satisfactory by the NASA evaluation pilots, with the 
largest effects occurring for the 6°-Iocked stabilator impair- 
ments. This impairment requires large stick offsets just to 
maintain level flight while the reconfigured system permits 
the pilot to control with normal stick position. Figure 13 is 
an example of the stick position change. The indication is 
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that after reconfiguration, no offset is required to maneuver 
command of the reconfigured aircraft. 

The OES diagnostics performed well, accurately deter- 
mining the fault for all scenarios flown. 

Conclusion 

Flight tests were conducted with the self-repairing flight 
control system (SRFCS) installed on the NASA F- 15 highly 
integrated digital electronic control (HIDEC) aircraft. The 
test results demonstrated the successful application of the 
SRFCS to a fighter aircraft The value of flight testing was 
also well-documented with in-flight evaluation of all tech- 
nical areas. 

Key highlights of the flight results include: 

1. The fault detection isolation and estimation (FDIE) 
overall performance was good, with no false detection 
for the maneuvers flown. The method used is depen- 
dent on aircraft model fidelity used in the system. 

2. The reconfiguration technique clearly benefits the pi- 
lot for large impairments. The results indicate that 
the larger the impairments, the greater the benefit of 
a SRFCS. 

3. The reconfiguration sequence of FDIE and subsequent 
reconfigured control is accurate for the selected maneu- 
vers of the flight test program. The flight test showed 
that the accuracy of the detection system is related to 
the magnitude of impairment of the degraded control 
and the related size of the error signature. 

4. The onboard expert system (OES) accurately identifies 
component faults of the kind that are intermittent with 
maneuver conditions. 
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Table 1. Test conditions. 

(a) Right-Stabilator Impairment. 

Locked at trim ~ 

Locked at +2° 

Locked at +4° 

Locked at +6° 

80-percent missing span 
100-percent missing span 
50-percent missing span 

(b) Test Maneuvers. 

Pitch and roll stick doublets 
Pushover and pullup 
3 -q windup turn 
3 -g bank-to-bank roll 

(c) Configuration. 

No impairment 
Impairment 

Impairment with fault detection 
Impairment with effector estimator 
Impairment with reconfiguration mixer 
Impairment with complete reconfiguration sequence 
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Fig. 1 NASA F-15 test vehicle offers high-capacity software for self-repairing flight demonstration. 
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Added SRFCS servo actuator 


Aileron actuator 


Fig. 2 Modified aileron control mechanism. 


Hawk/32 processor 

Program executive control 
Maintenance diagnostics 
Mixer 

SYSDYN aircraft models 

EGE 

FDIE 

Data handling (flight test) 
Access/control (flight test) 
Displays 

Digital flight computer 

CAS control laws with 
reconfiguration 


Memory, 

bytes 

Computation 
time, msec 

29,600 


38,395 

3.2 

10,179 

2.6 

49,770 

3.9 

14,222 

8.8 

30,357 

19.3 

6,681 

1.3 

128,548 

- 

13,675 

0.6 

Pitch 13,640 

Pitch 3.18 

Roll 13,900 

Roll 4.19 
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Fig. 3 F-15 aircrafl software requirements. 
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Systems modified 

for SRFCS 
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Fig. 4 F-15 aircraft SRFCS implementation. 
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Fig. 6 System impairment detection and classification of control surface failures. 
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Fig. 7 EGE process obtains impaired surface capability. 
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Fig. 8 Reconfiguration mixer restores control. 




"MO 


Failed 

surface 


250 H 


300 1 


3501 


30 
20 
"101 
400 J 0 

Ft STAB 


. 1 17 1 i t i i i — i — i lfl t i -. j £ 

+ 


.40 


~ 1 5 


"W" 


^ iv 20000 


- 6 - 


:3 

to 


-i j , 


20500 


hi 9500 


3 

RESET 5 
CAS 


Added display, 
maneuver limits 


Pilot 

action 


Added display, 
rudder limits 


10 1 '10 

Fig. 9 Pilot positive alert display triggered when fault is identified. 
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Fig. 10 F-15 SRFC5 flight demonstration test envelope. 


Fault 

scenario 

Maneuver 

conditions 

Failure 

indication 

major 

system 

Subsystem 

failed 

Cause 

1 

>3g 

Roll CAS 
disengage 

Dynamic pressure 
sensor 

Connector fails 
under g load 

2 

1 -g small 
pitch inputs 

None 

Stabilator surface 

Actuator connecting 
pin 

3 

1-g small 
pitch inputs 

Pitch, roll CAS 
disengage 

Stabilator actuator 

Hydraulic 

4 

2-g turn 

Autopilot 

disengage 

Inertial navigation 
system 

Platform stabilization 
fails under g load 

5 

! 5-g turn 

Pitch, roll CAS 
disengage 

Pitch computer 

Card A loose connection 
under g load 

6 

Pull-up 

CAS disengage 

Right angle-of- 
attack sensor 

Excessive friction 
in rotor 
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Fig. 11 In-flight maintenance diagnostics scenarios. 
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Fault detection, right stabilator partial missing 

Correction detection and verification: 60 percent 
Detection, no verification: 40 percent 

False detection or verification: 0 percent 

Fault detection, right stabilitor locked 

Correct detection: 1 00 percent 

Estimate of remaining stabilator surface 

Correct value, span missing: 51 percent 
(±20 percent tolerance) 

900246 

Fig. 12 Summary results of FDIE. 



Fig. 13 F- 15 SRFCS flight data; Mach 0.7, altitude = 20,000 ft. 
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